Basic

You just have to define a bean that returns a ServletContextInitializer.

Write the following code in an appropriate Application class

`Applcation.java`




    @Bean
    public ServletContextInitializer servletContextInitializer(@Value("${secure.cookie}")boolean secure) {
        return servletContext -> {
            servletContext.getSessionCookieConfig().setName("hogeSession");
        };
    }

set to httponly

`python`



        return servletContext -> {
            servletContext.getSessionCookieConfig().setHttpOnly(true);
        };

Add secure attribute


        return servletContext -> {
            servletContext.getSessionCookieConfig().setSecure(true);
        }

It may be a hindrance when developing locally, so it may be more convenient to get it from properties and set it to true in the prod setting.

    @Bean
    public ServletContextInitializer servletContextInitializer(@Value("${secure.cookie}")boolean secure) {
        return servletContext -> {
            servletContext.getSessionCookieConfig().setSecure(true);
        };
    }

Do not give JSESSIONID to URL

If cookies are not available, you will try to manage the session with the URL, which should be avoided. Even if cookies can be used, the JESSION ID will be given to the URL only for the first access. Since Spring Boot uses Servlet 3.0, you can narrow down to cookies only by setting Session Tracking Mode.



        return servletContext -> {
            servletContext.setSessionTrackingModes(Collections.singleton(SessionTrackingMode.COOKIE);
        };

This is synonymous with the following settings in web.xml.



<session-config>
  <tracking-mode>COOKIE</tracking-mode>
</session-config>

Summary

If you set these together, it will look like this



    @Bean
    public ServletContextInitializer servletContextInitializer(@Value("${secure.cookie}")boolean secure) {

        ServletContextInitializer servletContextInitializer = new ServletContextInitializer() {
            @Override
            public void onStartup(ServletContext servletContext) throws ServletException {
                servletContext.getSessionCookieConfig().setHttpOnly(true);
                servletContext.getSessionCookieConfig().setSecure(secure);
                servletContext.setSessionTrackingModes(
                        Collections.singleton(SessionTrackingMode.COOKIE)
                );
            }
        };
        return servletContextInitializer;
    }

reference https://www.glamenv-septzen.net/view/1093

Set cookies with Spring Boot